# CRA Readiness Checklist

## Scope
- [ ] Produit identifié
- [ ] Fabricant identifié
- [ ] Marchés UE identifiés
- [ ] Applicabilité CRA documentée
- [ ] Exclusions analysées
- [ ] Catégorie produit déterminée
- [ ] Classification importante/critique analysée

## Security
- [ ] Cybersecurity risk assessment
- [ ] Threat model
- [ ] Security requirements
- [ ] Secure architecture
- [ ] Secure defaults
- [ ] Authentication/authorization
- [ ] Cryptography where appropriate
- [ ] Secure update mechanism
- [ ] Logging/monitoring where appropriate

## Development
- [ ] Secure SDLC
- [ ] Code review
- [ ] Dependency management
- [ ] SBOM
- [ ] Security testing
- [ ] Release security review

## Vulnerabilities
- [ ] PSIRT / responsible owner
- [ ] Vulnerability intake
- [ ] Triage process
- [ ] Severity assessment
- [ ] Remediation workflow
- [ ] Coordinated disclosure process
- [ ] Reporting decision procedure
- [ ] CRA SRP access prepared

## Compliance
- [ ] Technical documentation
- [ ] Conformity assessment selected
- [ ] Evidence repository
- [ ] EU Declaration of Conformity where applicable
- [ ] CE process where applicable
- [ ] Support period documented

## Operations
- [ ] Security update process
- [ ] End-of-support process
- [ ] Incident response
- [ ] CRA reporting workflow
- [ ] Record retention